[KYUUBI #6927] add spnego ui with session manager. add spnego end-to-end ui rest by paradoxfm · Pull Request #17 · arenadata/kyuubi

paradoxfm · 2026-03-06T12:04:19Z

Add spnego ui with session manager. add spnego end-to-end ui rest

add conf parameter kyuubi.frontend.rest.ui.spnego.enabled
this functional also use spnego rest config

… rest

Asmoday · 2026-03-10T08:30:04Z

    server.addHandler(authenticationFactory.httpHandlerWrapperFactory.wrapHandler(proxyHandler))
    if (conf.get(FRONTEND_REST_UI_ENABLED)) {
      installWebUI()
+      // JettyUtils.createStaticHandlerSpnego("", "", "", "", "")


Why is that here?

Asmoday · 2026-03-10T08:30:49Z

+          val principal = authenticate(httpReq, httpResp) // auth SPNEGO
+
+          if (principal != null) {
+            // Создаем новую сессию


All comments must be in English.

Asmoday · 2026-03-10T08:35:48Z

+    val authorization = getAuthorization(request)
+    val clientToken = Base64.getDecoder.decode(authorization)
+    try {
+      debug("step by step spnego ui")


Asmoday · 2026-03-10T08:35:54Z

+    try {
+      debug("step by step spnego ui")
+      val serverPrincipal = getTokenServerName(clientToken)
+      debug("step 2 getTokenServerName")


Asmoday · 2026-03-10T08:36:02Z

+          s"Invalid server principal $serverPrincipal decoded from client request")
+      }
+
+      debug("step 3 startsWith")


Asmoday · 2026-03-10T08:36:10Z

+          }
+        })
+
+      debug("step 4 doAs")


Asmoday · 2026-03-10T08:36:29Z

+      }
+      if (!gssContext.isEstablished) {
+        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED)
+        debug("SPNEGO in progress")


Asmoday · 2026-03-10T08:38:05Z

+  private var serverSubject = new Subject()
+  private var keytab: String = _
+  private var principal: String = _
+  private val sessionTimeout = conf.get(KyuubiConf.SESSION_IDLE_TIMEOUT).toInt


loss of accuracy?

SESSION_IDLE_TIMEOUT measure in seconds, but all numbers in config stored as long
it`s preconversion for usage

With the current code and default config, the session will live 21 600 000 seconds instead of 6 hours.

its not a constant and also configurable

fallbackConf(SESSION_TIMEOUT) createWithDefault(Duration.ofHours(6).toMillis)

you can change it in kyuubi.defaults -> kyuubi.session.idle.timeout

Asmoday · 2026-03-10T08:39:36Z

+        httpResp.setHeader(WWW_AUTHENTICATE_HEADER, "Negotiate") // it must before sendError
+        httpResp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "No SPNEGO token")
+
+      case authHeader if authHeader.startsWith("Negotiate ") =>


AuthSchemes.NEGOTIATE ?

in this case must be with space, because exists variants with "Negotiate-something" etc

Asmoday · 2026-03-10T08:41:14Z

        httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED)
+        if (conf.get(FRONTEND_REST_UI_SPNEGO_ENABLED)) {
+          // For using rest from ui required end-to-end auth
+          httpResponse.setHeader(WWW_AUTHENTICATE_HEADER, "Negotiate")


What about requests that are not from the UI - /v1/*?

this header indicates client to what protocol work with. it does not change normal work mode

Many HTTP clients auto-react to this header. It change auth scheme priority.

it header will be added if matchedHandler == null. it mean that other schemes not found

matchedHandler == null means that the client has not yet attempted to authenticate.
What will happen with LDAP + UI Spnego case?

spnego works only kerberros. its end-to-end scheme. ui -> rest -> ...

Asmoday · 2026-03-10T08:48:25Z

Please add tests to AuthenticationFilterSuite.

Asmoday · 2026-03-10T09:37:01Z

Why create a new SpnegoSessionFilter instead of work with the KerberosAuthenticationHandler? The SPNEGO logic in both classes is identical.
Could SpnegoSessionFilter simply delegate authentication to KerberosAuthenticationHandler and only add session caching on top?

paradoxfm · 2026-03-10T09:43:51Z

Why create a new SpnegoSessionFilter instead of work with the KerberosAuthenticationHandler? The SPNEGO logic in both classes is identical. Could SpnegoSessionFilter simply delegate authentication to KerberosAuthenticationHandler and only add session caching on top?

because I need manage sessions, heades and hander wothks readonly, and does not work with principal start with HTTP/
I couldn't get it to work notmaly

Asmoday · 2026-03-10T09:53:31Z

Why create a new SpnegoSessionFilter instead of work with the KerberosAuthenticationHandler? The SPNEGO logic in both classes is identical. Could SpnegoSessionFilter simply delegate authentication to KerberosAuthenticationHandler and only add session caching on top?

because I need manage sessions, heades and hander wothks readonly, and does not work with principal start with HTTP/ I couldn't get it to work notmaly

readonly?
That won't work?


class SpnegoSessionFilter(conf: KyuubiConf) extends Filter {                                                                                                                                                                                                                                                                                                              
    private val kerberosHandler = new KerberosAuthenticationHandler                                                                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                                                                                                                            
    override def init(cfg: FilterConfig): Unit = {
      kerberosHandler.init(conf)                                                                                                                                                                                                                                                                                                                                            
    }             

    override def doFilter {
...
      val auth = httpReq.getHeader("Authorization")
      ...
      
...
      val principal = kerberosHandler.authenticate(httpReq, httpResp)

      if (principal != null) {
        session
        ...

      }
    }

  }

paradoxfm · 2026-03-10T09:59:41Z

readonly? That won't work?

I`ll try

ADH-7478 add spnego ui with session manager. add spnego end-to-end ui…

b033b4f

… rest

github-actions bot added kind:documentation module:server module:common labels Mar 6, 2026

Asmoday self-requested a review March 6, 2026 12:13

Asmoday reviewed Mar 10, 2026

View reviewed changes

Asmoday requested changes Mar 10, 2026

View reviewed changes

Asmoday reviewed Mar 10, 2026

View reviewed changes

Asmoday requested changes Mar 10, 2026

View reviewed changes

iGurkin added 3 commits March 10, 2026 15:24

ADH-7478 review

8f22811

ADH-7478 add tests

8fd20aa

ADH-7478 remove

db5e19a

Conversation

paradoxfm commented Mar 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Asmoday Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Asmoday commented Mar 10, 2026

Uh oh!

Asmoday commented Mar 10, 2026

Uh oh!

paradoxfm commented Mar 10, 2026

Uh oh!

Asmoday commented Mar 10, 2026

Uh oh!

paradoxfm commented Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Asmoday Mar 10, 2026 •

edited

Loading